Vulnerability Description
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Isaacs | Tar | < 7.5.7 |
Related Weaknesses (CWE)
References
- https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdbPatch
- https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4vExploitVendor Advisory
FAQ
What is CVE-2026-24842?
CVE-2026-24842 is a vulnerability with a CVSS score of 8.2 (HIGH). node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation...
How severe is CVE-2026-24842?
CVE-2026-24842 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-24842?
Check the references section above for vendor advisories and patch information. Affected products include: Isaacs Tar.